Get-AzAksCluster -Id appears to ignore subscription in resource ID and uses current context subscription

[andreasschild]

Description

Description

A platform team operating AKS clusters across many Azure subscriptions has observed unexpected behavior when using Get-AzAksCluster with a full Azure resource ID.

The expectation is that the cmdlet resolves the cluster based on the subscription embedded in the supplied resource ID. Instead, the cmdlet appears to use the subscription from the current Azure context and ignores the subscription contained in the resource ID when that subscription is not currently loaded as a context.

This behavior is particularly concerning in large-scale automation scenarios where identities may have access to many subscriptions and automation relies on Azure resource IDs being globally unique and self-contained.

Issue script & Debug output

$DebugPreference='Continue'
Set-AzContext -Subscription "714c36e4-xxxx-xxxx-xxxx"

# Works: Gets the cluster from the specified subscription
Get-AzAksCluster `
    -SubscriptionId "65be18f4-xxxx-xxxx-xxxx" `
    -ResourceGroupName "testing" `
    -Name "aks-testing"

# Doesn't work: Returns a not found or if a cluster with the same name 
# and the same resource group name it even returns a wrong cluster from the sub of the current context
Get-AzAksCluster `
    -Id "/subscriptions/65be18f4-xxxx-xxxx-xxxx/resourceGroups/testing/providers/Microsoft.ContainerService/managedClusters/aks-testing"


[...]
        === Token Acquisition finished successfully:
[...]
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/714c36e4-xxxx-xxxx-xxxx/resourceGroups/testing/providers/Microsoft.ContainerService/managedClusters/aks-testing?api-version=2026-03-01

Headers:
Accept-Language               : en-US
x-ms-client-request-id        : 6bbec8ed-f87f-487f-81c7-ec6e8a58f447

Body:

DEBUG: [AcquirePolicyTokenHandler] Intercept GET https://management.azure.com/subscriptions/714c36e4-xxxx-xxxx-xxxx/resourceGroups/testing/providers/Microsoft.ContainerService/managedClusters/aks-testing?api-version=2026-03-01
DEBUG: [AcquirePolicyTokenHandler] Skip: verb not allowed for token acquisition.
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
NotFound

Headers:
Cache-Control                 : no-cache
Pragma                        : no-cache
x-ms-failure-cause            : gateway
x-ms-request-id               : 770535e1-aa36-4883-a4b5-d2965412fd62
x-ms-correlation-request-id   : 770535e1-aa36-4883-a4b5-d2965412fd62
x-ms-routing-request-id       : GERMANYWESTCENTRAL:20260730T083517Z:770535e1-aa36-4883-a4b5-d2965412fd62
Strict-Transport-Security     : max-age=31536000; includeSubDomains
X-Content-Type-Options        : nosniff
X-Cache                       : CONFIG_NOCACHE
X-MSEdge-Ref                  : Ref A: 8C68EFB50170412F8D73B22B9C6DE0CB Ref B: FRA231050411025 Ref C: 2026-07-30T08:35:16Z
Date                          : Thu, 30 Jul 2026 08:35:16 GMT

Body:
{
  "error": {
    "code": "ResourceNotFound",
    "message": "The Resource 'Microsoft.ContainerService/managedClusters/aks-testing' under resource group 'testing' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
  }
}

[...]

Environment data

Name                           Value
----                           -----
PSVersion                      7.6.4
PSEdition                      Core
GitCommitId                    7.6.4
OS                             Microsoft Windows 10.0.26200
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.4
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     5.5.1                 Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script     7.2.1                 Az.Aks                              {Disable-AzAksAddOn, Enable-AzAksAddOn, Get-AzAksCluster, Get-AzAksNodePool…}

Error output

HistoryId: 8

RequestId      :
Message        : Operation returned an invalid status code 'NotFound'
ServerMessage  :
ServerResponse : {NotFound}
RequestMessage : {GET https://management.azure.com/subscriptions/714c36e4--xxxx-xxxx-xxxx/resourceGroups/testing/providers/Microsoft.ContainerService/manag
                 edClusters/aks-testing?api-version=2026-03-01}
InvocationInfo : {Get-AzAksCluster}
Line           : Get-AzAksCluster -Id
                 "/subscriptions/65be18f4--xxxx-xxxx-xxxx/resourcegroups/testing/providers/Microsoft.ContainerService/managedClusters/aks-testing"
Position       : At line:1 char:1
                 + Get-AzAksCluster -Id "/subscriptions/65be18f4--xxxx-xxxx-xxxx …
                 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
StackTrace     :    at Microsoft.Azure.Commands.Aks.KubeCmdletBase.RunCmdLet(Action action)
                    at Microsoft.Azure.Commands.Aks.GetAzureRmAks.ExecuteCmdlet()
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.<>c__3`1.<ExecuteSynchronouslyOrAsJob>b__3_0(T c)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet, Action`1 executor)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
HistoryId      : 8

[azure-client-tools-agent]

Bug Analysis

Get-AzAksCluster accepts a full resource -Id parameter but the underlying client call appears to build the request using the current Azure context's subscription instead of the subscription segment embedded in the supplied resource ID. This means:

• When the resource ID's subscription differs from the current context's subscription, the cmdlet returns ResourceNotFound (404) — the HTTP request in the repro is built against the context subscription (714c36e4-...) rather than the ID's subscription (65be18f4-...).
• Worse, if a cluster with the same name/resource group happens to exist in the context subscription, the cmdlet silently returns the wrong cluster.

This breaks the guarantee that a fully-qualified Azure resource ID is self-contained and globally addressable — critical for automation across many subscriptions.

Expected fix: When -Id is supplied, parse the subscription ID out of the resource ID and use it for the underlying REST call (overriding/ignoring the current context's subscription for this call), consistent with how other cmdlets handle -Id parameter sets.

Investigation pointers:

• Look at the Get-AzAksCluster cmdlet implementation in src/Aks (likely GetAzureRmManagedClusterCommand or similar) and how the -Id parameter set resolves SubscriptionId for the generated client.
• Compare against other Get-Az* cmdlets in the same module (or track SDK-generated client) that correctly parse -Id to extract SubscriptionId, ResourceGroupName, and resource name.
• Add/adjust a ChangeLog.md entry under src/Aks/Aks.

Use this EXACT PR title: [Aks] resolve subscription from the resource ID instead of the current context

PR title & description (azure-powershell)

Follow CONTRIBUTING.md. azure-powershell does not enforce a strict title gate — it requires a clear, informative title and a fully filled-out PR template.

Suggested PR title (clear & informative; [Module] prefix is the common convention):

[Aks] resolve subscription from the resource ID instead of the current context

Required (per CONTRIBUTING.md):

• Fill out the PR template completely — PRs are not reviewed without the completed checklist; do not delete it.
• Link the issue — include Fixes #29928 in the description so the PR auto-closes it.
• ChangeLog — add a bullet describing the fix under the ## Upcoming Release header of src/Aks/Aks/ChangeLog.md. Do not add a new version header.
• Target branch — main.
• Tests — add/adjust test coverage for the change. Tests must not contain hardcoded values (location, resource id, etc.) and must be re-recordable; do not skip existing tests.
• Scope — keep the change limited to the affected module (src/Aks/).

---

Posted by agent-assist (autonomous bug-fix pipeline).